1. What are the implications of having this included in the firmware of SSD drives and how would you acquire such a drive?

The implications are wide ranging, but essentially the volume of recoverable data may be reduced. (Forensic analysis of deleted items, system artefacts, etc may not be possible). However, acquisition methods will not be affected.

2. Does the firmware start clearing sectors when it is simply to a power supply or does it require other hardware to be attached?

3. If it starts clearing sectors when connected to a power supply what legal implication will this have if during the acquisition of the drive potential evidence is been deleted by the built-in firmware before if can be forensically acquired ?

On my daily trawl through various feeds, thanks Google Reader for making this so easy, I came across an article that discussed the "benefits" of this new firmware. While I tend to agree with the write from a performance standpoint the IT Forensics voice in my head was saying this could make my job more interesting.

This firmware is designed to keep the speed of the SSD drive as close as possible to that of a new drive even if the drive has been used over a long period of time . The flash memory used on the SSD drive is comprised of cells that usually contain 4KB pages that are arranged in blocks of 512KB. When a cell is unused, data can be written to it relatively quickly. But if a cell already contains some data, no matter how little even if it fills only a single page in the block,the entire block must be re-written.

This is because a memory cell has to be empty to have data written on it, even if it's only partially filled. The data already co…

If like me you update and deploy software to new workstation on a regular basis you will quickly grow tired of installing MS Office and then installing the latest service pack. This quick guide will assist in slipstreaming the latest service pack (SP2) into MS Office 2007. I will assume that you will be installing office from a network share and have already copied the entire contents of the CD to this folder.

Download the standalone installer office2007sp2-kb953195-fullfile-en-us.exe to a temporary folder (c:\tmp)Create folder called Updates (C:\Updates)Open a command line window (CMD) and type the following on one line:

Download the OS Pre-Install sata drivers and extract to a temporery location on the machine (c:\tmp).

Open Device Managerunder IDE ATA/ATAPI controllers you should see something like : Intel ICH9 Serial ATA Storage Controller.Right-Click on that and select Update DriverSay no to connecting to Windows Update to search, hit NextSelect Install from a list or specific location (Advanced), hit NextSelect "Don't search. I will choose the driver to install", hit NextSelect Have DiskBrowse to the Driver folder (c:\tmp\) and highlight the iastor.inf file, hit Open Select OK

Now you should have a list of controllers ICH9 /AHCI driverYou'll get warned that installing the device driver is not recommended, click Yes to continue installingClick FinishIf you have more than one Intel ICH9 Serial ATA Storage Controller you will need to do this for each before restartingWhen system boots enter the bios, navigate to the SATA Operation option or equivlant and set it to AHCIVerify your sat…